1a4cd5bbbbd14dd406a54082778e8da2cbcea83e04fa05957f345daedaa5f7dd

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 18:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a26a4bd2586d13bca78597254180bf01.js
Size 982KB
Sample240224-wsj34aad75
SHA256 1a4cd5bbbbd14dd406a54082778e8da2cbcea83e04fa05957f345daedaa5f7dd
MD5 a26a4bd2586d13bca78597254180bf01
SHA1 911e9e29caa44600f547e26d94c98c61c94d2c16
SHA512 fc137b3f78c357281573e7eb0ca3a3f1dc087460ef67b221f532b795ba50feea11d06efca230c59a8d368c18acffde384041ff290d5beae90f505b9d332f32a8
SSDEEP 12288:28feM/AN7advmjFB6fsAp/cdeZLSNklJTTGzMj/PgU8qcS:28CNmdvmXSpwuGM7wS
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation	wscript.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
324	icacls.exe

Drops file in Program Files directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4068	java.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1092	1764	wscript.exe	87
PID 1764 wrote to memory of 1092	1764	wscript.exe	87
PID 1092 wrote to memory of 324	1092	javaw.exe	88
PID 1092 wrote to memory of 324	1092	javaw.exe	88
PID 1092 wrote to memory of 4068	1092	javaw.exe	90
PID 1092 wrote to memory of 4068	1092	javaw.exe	90

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\a26a4bd2586d13bca78597254180bf01.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\ywpjvv.txt"
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
    3⤵
    - Modifies file permissions
    PID:324
- - C:\Program Files\Java\jre-1.8\bin\java.exe
    "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.19091349765017351189878544747189635.class
    3⤵
    - Drops file in Program Files directory
    - Suspicious use of SetWindowsHookEx
    PID:4068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 6e5bb75105937fdbf7a45230321a0334ed79e0845a6bdd9a141e6c7df5f91817
MD5 4829f62e1781f58c0f2fb07f65b61068
SHA1 9eccd5ed031a48dee4bdb7df78ef676269d1ac19
SHA512 be1d7711d01d1392afa55c7185c4ba6a263962b0c8538069392523f63c55f868c49ea27ba6948e6e43f48644ee8ecb35be9d5029432a8cb209b22e4f5099b132
MD5 SHA1 SHA512

Submit Download

_0.19091349765017351189878544747189635.class

Path C:\Users\Admin\AppData\Local\Temp\_0.19091349765017351189878544747189635.class
Size 241KB
SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
MD5 781fb531354d6f291f1ccab48da6d39f
SHA1 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA512 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8
SSDEEP 6144:WI5pxUZ7Gvi8ulm+yV/rIF0/MO2qnan1J7pXESN6U:J5pxAGqNkrIq/MO2qnA
MD5 SHA1 SHA512 SSDEEP

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_721196e6-b31c-4e5d-b8d6-136c757b28ae

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3844919115-497234255-166257750-1000\83aa4cc77f591dfc2374580bbd95f6ba_721196e6-b31c-4e5d-b8d6-136c757b28ae
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

ywpjvv.txt

Path C:\Users\Admin\AppData\Roaming\ywpjvv.txt
Size 473KB
SHA256 2142c2eeac1f1a8e5b19e986ee721aff370a6a21c9a07a50703de01a5e65b0b1
MD5 bf44cb190c24679c6852441f37a0ae36
SHA1 811d6120c00fcb66607447c3fcc8442aa4035974
SHA512 bb9ea6b2f04bdaa6e625b96ce43ad84840ba52560f33092ac2cefafc41fc421615bcf7a3e42655414b6394c900cf91a162f0c620cdf1794d90403b09e31d5249
SSDEEP 12288:Uhsv3cuVBJYDdraR5pxogQNUhIK/0c2qnAp:Yu3ODdra3sS7B2qn8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1092-4-0x0000029ACF6F0000-0x0000029AD06F0000-memory.dmp

Download

memory/1092-13-0x0000029ACF6D0000-0x0000029ACF6D1000-memory.dmp

Download

memory/1092-82-0x0000029ACF6F0000-0x0000029AD06F0000-memory.dmp

Download

memory/4068-33-0x0000028232130000-0x0000028232131000-memory.dmp

Download

memory/4068-53-0x0000028233790000-0x0000028234790000-memory.dmp

Download

memory/4068-55-0x0000028233790000-0x0000028234790000-memory.dmp

Download

memory/4068-59-0x0000028233790000-0x0000028234790000-memory.dmp

Download

memory/4068-63-0x0000028233790000-0x0000028234790000-memory.dmp

Download

memory/4068-66-0x0000028232130000-0x0000028232131000-memory.dmp

Download

memory/4068-72-0x0000028232130000-0x0000028232131000-memory.dmp

Download

memory/4068-32-0x0000028233790000-0x0000028234790000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads